Provenance Record

Well-structured News-category piece (888 words, within the 400-1200 range) using the Overview / What We Know / What We Don't Know / Analysis format. Clear, neutral, technically precise prose. The 'What We Don't Know' section appropriately flags the absence of a CVE identifier, the unknown patch-adoption rate, and the unpublished full technical paper, which is good editorial discipline.

All 4 sources fetched successfully (status 200) and snapshots were read in full from disk after gunzip; recomputed SHA-256 of each decompressed file matched the manifest exactly (source-0 be7803bd...67da37, source-1 b443baee...ae6a059, source-2 bf787b41...58c51b7569, source-3 b093b3c2...6b0d252d), so provenance integrity is confirmed and no live WebFetch fallback was needed. Source-0 (today.ucsd.edu, UC San Diego press release) confirms: 'at least 2.2 million' vehicles, the KARR/SWDS sticker, Honda/Toyota/Mazda/Ford/Jeep dealerships in Southern California 2017-present, spread to Canada/Japan via resale, the shared-key design flaw, five-yard attack range, the ability to prevent a stopped (not running) car from starting, Rockledge as a similar-device maker, the credit-card-skimmer discovery origin, the full author list (Yu, Wei, Rao, Vaswani, Chien, Bhaskar as alumnus, Schulman, Dameff of UC San Diego Health), the DEF CON (Aug 9)/USENIX Security (Aug 12) presentation dates, the July 20, 2026 Acrisure firmware patch delivered via the KARR app, and verbatim quotes from Jerry Yu ('Instead of smashing a window...') and Aaron Schulman ('Many car owners don't even know...'). Source-1 (theregister.com) independently confirms the 2.2 million figure, five-yard range, the 'all ... rely on the same secure key' phrase, the Yibo Wei removal-difficulty quote (in full -- see finding on truncation), and the KARR spokesperson quote about 'highly complex' / 'low risk' (verbatim) plus the 'small percentage of devices' claim (see finding on paraphrase-as-quote). Source-2 (malwarebytes.com) confirms 'Acrisure Protection Group' as the manufacturer's full name, the continuous Bluetooth-broadcast/WiGLE tracking claim, the beep-and-flicker-with-no-owner-alert detail, and precisely verifies the disclosure timeline: 'UC San Diego disclosed the flaw to Acrisure in January 2025, but a firmware fix did not arrive until July 20, 2026 -- roughly 18 months later' (verbatim match to the article's wording and date arithmetic -- January 2025 to July 2026 is correctly ~18 months), plus the verbatim line 'Roughly a million people cannot patch what they do not know exists,' which the article correctly attributes to Malwarebytes' own writing rather than to a named individual. Source-3 (thedrive.com) confirms the 10-minute post-shutdown Bluetooth radio window (verbatim) and the unnamed-professor 'probably the worst' quote, which the article correctly flags as unattributed by the outlet ('though the outlet did not name which professor made the remark') rather than guessing at a name.

The 2.2 million vehicle count and the January 2025-to-July 20, 2026 (~18 month) disclosure-to-patch timeline were both specifically checked against source text as instructed and are accurate and directly traceable (UC San Diego states 'at least 2.2 million'; Malwarebytes states the January 2025 disclosure and July 20, 2026 patch date and does the '18 months' arithmetic itself). No CVE identifier appears in any of the four sources, consistent with the article's claim. Two subordinate quote-fidelity issues were found (see findings) -- one truncated quote missing a trailing clause without an ellipsis, and one instance where a reporter's paraphrase in the cited outlet is presented as if it were a spokesperson's verbatim words. Both concern subordinate body claims, not the headline, summary, or lead, and both preserve the correct substantive meaning of what was said.

Substantively strong, well-sourced, accurate reporting on a newly disclosed vulnerability -- the headline, summary, and every specific number (2.2 million vehicles, five-yard range, 18-month patch timeline, DEF CON/USENIX dates) trace cleanly to the cited sources, all of which were read in full from disk snapshots with verified hashes. Two isolated quote-fidelity issues in subordinate body claims (not the lead) are honestly coverable by a single corrections record, so APPROVE_WITH_CORRECTIONS rather than REJECT is the right call.